CWE-200 · Information Disclosure (page 87)
Page 87 of 100 — CVEs classified under CWE-200, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2295 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |
CVE-2016-2311 | Medium | 6.5 | 2016-05-30 | Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with… |
CVE-2016-2025 | High | 7.5 | 2016-05-30 | HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related… |
CVE-2016-2023 | Medium | 5.5 | 2016-05-30 | HPE RESTful Interface Tool 1.40 allows local users to obtain sensitive information via unspecified vectors. |
CVE-2016-1404 | High | 7.5 | 2016-05-29 | Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers'… |
CVE-2016-1410 | High | 7.5 | 2016-05-28 | Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hostin… |
CVE-2016-3664 | High | 7.4 | 2016-05-23 | Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middl… |
CVE-2016-4913 | High | 7.8 | 2016-05-23 | The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, w… |
CVE-2016-4580 | High | 7.5 | 2016-05-23 | The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which… |
CVE-2016-4578 | Medium | 5.5 | 2016-05-23 | sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information fro… |
CVE-2016-4569 | Medium | 5.5 | 2016-05-23 | The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users… |
CVE-2016-4486 | Low | 3.3 | 2016-05-23 | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local use… |
CVE-2016-4485 | High | 7.5 | 2016-05-23 | The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain s… |
CVE-2016-4482 | Medium | 6.2 | 2016-05-23 | The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local user… |
CVE-2016-2158 | Medium | 4.3 | 2016-05-22 | lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin f… |
CVE-2016-2156 | Medium | 4.3 | 2016-05-22 | calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event… |
CVE-2016-2154 | Medium | 4.3 | 2016-05-22 | admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewh… |
CVE-2016-2151 | Medium | 4.3 | 2016-05-22 | user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on… |
CVE-2016-3693 | High | 8.1 | 2016-05-20 | The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensit… |
CVE-2016-1858 | Medium | 6.5 | 2016-05-20 | WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obt… |
CVE-2016-1853 | High | 7.5 | 2016-05-20 | Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support. |
CVE-2016-1852 | Low | 2.4 | 2016-05-20 | Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sen… |
CVE-2016-1849 | Low | 3.3 | 2016-05-20 | The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing… |
CVE-2016-1802 | Medium | 5.5 | 2016-05-20 | CCCrypt in CommonCrypto in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 mishandles return values during key-length… |
CVE-2016-1801 | High | 7.5 | 2016-05-20 | The CFNetwork Proxies subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 mishandles URLs in http and https requests, which allows… |
CVE-2016-1796 | Low | 3.3 | 2016-05-20 | Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information or cause a denial of service (out-… |
CVE-2016-1791 | Low | 3.3 | 2016-05-20 | The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. |
CVE-2016-3727 | Medium | 4.3 | 2016-05-17 | The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the mast… |
CVE-2016-3724 | Medium | 6.5 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job… |
CVE-2016-3723 | Medium | 4.3 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging m… |
CVE-2016-3674 | High | 7.5 | 2016-05-17 | Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDri… |
CVE-2016-0306 | Medium | 5.9 | 2016-05-17 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which… |
CVE-2015-3412 | Medium | 5.3 | 2016-05-16 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read ar… |
CVE-2016-0341 | High | 7.5 | 2016-05-15 | IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 through 1.0.0.4 do not require HTTPS, which might allow re… |
CVE-2016-2298 | Critical | 9.8 | 2016-05-14 | Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors. |
CVE-2016-1206 | Medium | 4.3 | 2016-05-14 | The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attacker… |
CVE-2016-2015 | High | 7.1 | 2016-05-14 | HPE System Management Homepage before 7.5.5 allows local users to obtain sensitive information or modify data via unspecified vectors. |
CVE-2016-1208 | High | 7.5 | 2016-05-14 | The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors. |
CVE-2016-4536 | Medium | 5.3 | 2016-05-13 | The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrBy… |
CVE-2016-2849 | High | 7.5 | 2016-05-13 | Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow re… |
CVE-2015-7827 | High | 7.5 | 2016-05-13 | Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to… |
CVE-2016-1112 | Critical | 9.8 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1092 | High | 7.5 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1079 | High | 7.5 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-0194 | Medium | 5.3 | 2016-05-11 | Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site, aka "Internet… |
CVE-2016-0190 | Medium | 5.5 | 2016-05-11 | Volume Manager Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 does not properly check whether RemoteFX RDP USB disk acces… |
CVE-2016-0175 | Low | 3.3 | 2016-05-11 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-0169 | Medium | 6.5 | 2016-05-11 | GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Window… |
CVE-2016-0168 | Medium | 6.5 | 2016-05-11 | GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Window… |
CVE-2016-0149 | Medium | 5.9 | 2016-05-11 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via v… |
CVE-2016-2460 | Medium | 5.5 | 2016-05-09 | mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which a… |
CVE-2016-2459 | Medium | 5.5 | 2016-05-09 | mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which a… |
CVE-2016-2458 | Medium | 5.5 | 2016-05-09 | The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, whi… |
CVE-2015-6551 | Medium | 5.9 | 2016-05-07 | Veritas NetBackup 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4 and NetBackup Appliance through 2.5.4 and 2.6.0.x through 2.6.0.4 do not use TLS for administ… |
CVE-2016-2013 | Medium | 6.5 | 2016-05-07 | HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to obtain sensitive information via unspecified ve… |
CVE-2016-3717 | Medium | 5.5 | 2016-05-05 | The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image. |
CVE-2016-2107 | Medium | 5.9 | 2016-05-05 | The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows rem… |
CVE-2016-0893 | Medium | 4.3 | 2016-05-03 | EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages. |
CVE-2016-2117 | High | 7.5 | 2016-05-02 | The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remo… |
CVE-2015-4176 | Medium | 5.5 | 2016-05-02 | fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging us… |
CVE-2016-2813 | Medium | 6.5 | 2016-04-30 | Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sen… |
CVE-2016-1199 | Medium | 5.3 | 2016-04-30 | The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecifie… |
CVE-2016-1185 | Low | 2.5 | 2016-04-25 | The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application. |
CVE-2016-1595 | Medium | 6.5 | 2016-04-22 | LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibe… |
CVE-2016-1594 | Medium | 6.5 | 2016-04-22 | Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated… |
CVE-2016-3145 | Medium | 4.6 | 2016-04-22 | Lexmark printers with firmware ATL before ATL.021.063, CB before CB.021.063, PP before PP.021.063, and YK before YK.021.063 mishandle Erase Printer Memory and… |
CVE-2016-2304 | Medium | 4.3 | 2016-04-22 | Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attac… |
CVE-2016-2302 | Medium | 5.3 | 2016-04-22 | Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive information by reading detailed error messages. |
CVE-2016-2294 | High | 7.5 | 2016-04-21 | The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover a cleartext mail-server passw… |
CVE-2015-7511 | Low | 2.0 | 2016-04-19 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attacker… |
CVE-2015-1776 | Medium | 6.2 | 2016-04-19 | Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the… |
CVE-2016-3688 | Medium | 6.5 | 2016-04-19 | SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/U… |
CVE-2016-1658 | Medium | 4.3 | 2016-04-18 | The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attacker… |
CVE-2016-1651 | High | 8.1 | 2016-04-18 | fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb f… |
CVE-2016-2427 | Medium | 5.5 | 2016-04-18 | The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for… |
CVE-2016-2426 | Medium | 5.5 | 2016-04-18 | server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 do… |
CVE-2016-2425 | Medium | 5.5 | 2016-04-18 | mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 supports file:///… |
CVE-2016-2415 | Medium | 5.5 | 2016-04-18 | exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2… |
CVE-2015-5271 | High | 7.5 | 2016-04-15 | The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb… |
CVE-2016-2212 | Medium | 5.3 | 2016-04-15 | The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3… |
CVE-2015-8336 | Medium | 4.3 | 2016-04-14 | Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspeci… |
CVE-2016-1378 | Medium | 5.3 | 2016-04-14 | Cisco IOS before 15.2(2)E1 on Catalyst switches allows remote attackers to obtain potentially sensitive software-version information via a request to the Netwo… |
CVE-2016-0787 | Medium | 5.9 | 2016-04-13 | The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middl… |
CVE-2016-0739 | Medium | 5.9 | 2016-04-13 | libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 1… |
CVE-2016-3686 | Medium | 5.9 | 2016-04-13 | The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote attackers to obtain s… |
CVE-2016-3159 | Low | 3.8 | 2016-04-13 | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allow… |
CVE-2016-3158 | Low | 3.8 | 2016-04-13 | The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows l… |
CVE-2016-2084 | High | 7.4 | 2016-04-13 | F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11… |
CVE-2016-2055 | High | 7.5 | 2016-04-13 | xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "c… |
CVE-2015-8555 | High | 8.6 | 2016-04-13 | Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register… |
CVE-2015-8553 | Medium | 6.5 | 2016-04-13 | Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control… |
CVE-2016-1035 | High | 7.5 | 2016-04-12 | Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors. |
CVE-2016-0887 | Medium | 5.9 | 2016-04-12 | EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J… |
CVE-2016-0090 | High | 7.1 | 2016-04-12 | Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafte… |
CVE-2016-0089 | High | 7.1 | 2016-04-12 | Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via… |
CVE-2016-3170 | Medium | 5.3 | 2016-04-12 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive usern… |
CVE-2016-2166 | Medium | 6.5 | 2016-04-12 | The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly… |
CVE-2016-2140 | Medium | 5.3 | 2016-04-12 | The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to f… |
CVE-2015-8537 | Medium | 5.3 | 2016-04-12 | app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by… |
CVE-2015-8473 | Medium | 4.3 | 2016-04-12 | The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changes… |